EUVD-2026-60946
GHSA-9gwv-2w2h-phfh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Network-delivered, no privileges needed, user interaction required to visit the page; scope change because browser chrome is compromised; integrity-only impact via UI spoofing.
Primary rating from Vendor (59469e6c-7ea7-446f-8e43-06aa32c115e8).
CVSS VectorVendor: 59469e6c-7ea7-446f-8e43-06aa32c115e8
Lifecycle Timeline
3DescriptionCVE.org
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk.
AnalysisAI
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must be running ArcSearch for iOS on a version prior to 1.48.0 and must navigate to an attacker-controlled page - via a tapped link in a phishing message, a malicious advertisement, or a redirect from a compromised legitimate site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.4 score is driven by Scope Changed (S:C) and High Integrity impact (I:H), which accurately reflects that this vulnerability breaches the boundary between web content and browser chrome - a meaningful security boundary. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Users should update ArcSearch for iOS to version 1.48.0 or later, which resolves the address bar spoofing behavior. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, issue an urgent security advisory to all ArcSearch iOS users regarding CVE-2026-18534; contact ArcSearch support to confirm the release timeline for patched version 1.48.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today